Security Fundamentals Professional Certification (SFPC) — Questions and Answers

Question 1: A senior management official is presented with an authorization package that includes the System Security Plan (SSP), the Security Assessment Report (SAR), and a Plan of Action and Milestones (POA&M). By signing the Authorization to Operate (ATO), what is this official formally doing?

Certifying that all security controls have been implemented perfectly.
Confirming that all items in the POA&M have been fully remediated.
Approving the budget for the next three years of security operations.
Accepting the remaining residual risk of operating the information system. (Correct answer)

Correct answer: Accepting the remaining residual risk of operating the information system.

The 'Authorize' step of the RMF culminates in a senior official, the Authorizing Official (AO), making a formal decision. By granting an Authorization to Operate (ATO), the AO is formally accepting the security and privacy risk to the organization based on the implementation of controls and the plan to address remaining weaknesses, which is known as residual risk.

Question 2: What is a 'security lighting' requirement and how does it contribute to physical security?

Illumination that deters unauthorized activity by reducing concealment opportunities and enabling surveillance cameras to capture clear images (Correct answer)
Lighting used only during emergencies
Decorative lighting for facility aesthetics
Lighting that automatically activates during fire alarms

Correct answer: Illumination that deters unauthorized activity by reducing concealment opportunities and enabling surveillance cameras to capture clear images

Security lighting deters unauthorized access by eliminating dark areas where intruders could conceal themselves and improving visibility for security patrols and surveillance cameras.

Question 3: What is the significance of 'indoctrination acknowledgment' when gaining SAP access?

A routine administrative form with no legal significance
An optional form that may be waived
A verbal agreement with a supervisor
A formal written acknowledgment of obligations under the SAP, including non-disclosure requirements, that creates legal accountability (Correct answer)

Correct answer: A formal written acknowledgment of obligations under the SAP, including non-disclosure requirements, that creates legal accountability

The indoctrination acknowledgment is a formal, legally significant document signed by the individual acknowledging their security obligations and non-disclosure requirements for the specific SAP.

Question 4: In the context of emergency management, what does 'shelter-in-place' mean?

Setting up temporary housing
Conducting drills in a specific location
Remaining in a building during an emergency (Correct answer)
Evacuating to a designated shelter

Correct answer: Remaining in a building during an emergency

Shelter-in-place means to take immediate shelter in the building you are already in rather than evacuating, often used during hazardous material incidents.

Question 5: What is the purpose of a 'polygraph examination' in personnel security?

To test language proficiency
To assess the credibility of statements made during a security interview and potentially detect deception (Correct answer)
To diagnose medical conditions
To evaluate intellectual capacity

Correct answer: To assess the credibility of statements made during a security interview and potentially detect deception

Polygraph examinations are used in personnel security to assess an individual's truthfulness and potentially detect deception when answering questions about their background.

Question 6: What is a 'security control baseline' in the NIST RMF?

A predefined set of security controls selected based on system categorization that serves as a starting point for tailoring (Correct answer)
A historical record of security incidents
A minimum performance standard for security personnel
The lowest acceptable security standard

Correct answer: A predefined set of security controls selected based on system categorization that serves as a starting point for tailoring

A security control baseline is a predefined set of minimum security controls selected based on the system's categorization level, which is then tailored for specific organizational needs.

Question 7: Which of the following is NOT a category of Information Technology (IT)?

Information Technology Applications (Correct answer)
Platform Information Technology (PIT)
Information Technology Services
Information Technology Products

Correct answer: Information Technology Applications

While the phrase 'sole authority' is generally inaccurate in security policy, the markings on classified information are crucial for the document holder to understand the information's classification level, handling caveats, and dissemination restrictions. These markings guide the document holder in making responsible determinations regarding the information's transfer and dissemination, ensuring compliance with established security policies and need-to-know principles.

Question 8: What is 'biometric authentication' and what advantage does it provide over traditional access cards?

A type of electronic keypad
Authentication using unique physical or behavioral characteristics that cannot easily be stolen, lost, or shared (Correct answer)
A backup authentication method
A method using multiple keys to open a lock

Correct answer: Authentication using unique physical or behavioral characteristics that cannot easily be stolen, lost, or shared

Biometric authentication uses unique physical traits (fingerprints, iris patterns, facial features) that are much harder to steal, duplicate, or share than access cards, providing stronger authentication.

Question 9: Which of the following is a key component of the Trusted Workforce 2.0 initiative, designed to modernize the personnel security process?

A one-time, comprehensive background investigation with no follow-up.
Continuous Vetting/Evaluation to monitor for new risk information in near real-time. (Correct answer)
Elimination of self-reporting requirements for security clearance holders.
Periodic reinvestigations conducted every ten years for all clearance levels.

Correct answer: Continuous Vetting/Evaluation to monitor for new risk information in near real-time.

Continuous Vetting (CV) or Continuous Evaluation (CE) is a cornerstone of the Trusted Workforce 2.0 reform. It replaces the traditional periodic reinvestigation model with ongoing, automated checks of various data sources to identify potential security risks as they arise.

Question 10: An organization is implementing a risk management program. After identifying potential threats and vulnerabilities, what is the logical next step in the risk management process?

Implement security controls.
Create an incident response plan.
Conduct a risk analysis. (Correct answer)
Monitor and review the risks.

Correct answer: Conduct a risk analysis.

The standard risk management process involves identifying assets, threats, and vulnerabilities, and then analyzing the risk. Risk analysis involves evaluating the likelihood of a threat exploiting a vulnerability and the potential impact it would have on the organization. This analysis is crucial before deciding which controls to implement.

Question 11: What is the primary purpose of a Facility Security Officer (FSO)?

Overseeing security of classified information and facilities (Correct answer)
Marketing facility services
Managing employee benefits
Conducting financial audits

Correct answer: Overseeing security of classified information and facilities

The FSO is responsible for the oversight, implementation, and management of security programs protecting classified information and the facility.

Question 12: A defense contractor needs to provide classification guidance to a subcontractor for a new classified project. Which document is specifically designed to convey these security requirements?

A formal Memorandum of Understanding (MOU)
DD Form 441, Security Agreement
SF-328, Certificate Pertaining to Foreign Interests
DD Form 254, Contract Security Classification Specification (Correct answer)

Correct answer: DD Form 254, Contract Security Classification Specification

The DD Form 254, Contract Security Classification Specification, is the official Department of Defense document used to convey security requirements and classification guidance for a classified contract to contractors and subcontractors.

Question 13: During a background investigation, an investigator discovers that the applicant deliberately omitted information about a prior arrest on their SF-86, Questionnaire for National Security Positions. Under which adjudicative guideline would this be a primary concern?

Guideline B: Foreign Influence
Guideline F: Financial Considerations
Guideline I: Psychological Conditions
Guideline E: Personal Conduct (Correct answer)

Correct answer: Guideline E: Personal Conduct

Guideline E, Personal Conduct, addresses issues of questionable judgment, lack of candor, dishonesty, and unwillingness to comply with rules and regulations. Deliberately falsifying information on a security questionnaire is a significant issue under this guideline.

Question 14: What is 'opsec' as it applies to personal behavior?

Avoiding all electronic devices
Wearing disguises in public
Being mindful of what personal information you reveal that could be used against you (Correct answer)
Using encrypted communications only

Correct answer: Being mindful of what personal information you reveal that could be used against you

Personal OPSEC involves being conscious of what information about yourself you reveal, ensuring that sensitive personal information doesn't fall into the hands of adversaries.

Question 15: What is a 'defense-in-depth' approach to physical security?

Using multiple concentric layers of security controls so that an attacker must overcome multiple barriers to reach the protected area (Correct answer)
Focusing all security resources on the outer perimeter
Deploying all security guards at the main entrance
Installing the most advanced technology available at a single checkpoint

Correct answer: Using multiple concentric layers of security controls so that an attacker must overcome multiple barriers to reach the protected area

A layered approach to physical security uses multiple concentric security rings so that an adversary must overcome each layer successively, significantly increasing the difficulty of reaching the protected target.

Question 16: What is 'compartmentation' in OPSEC?

Separating computer networks physically
Dividing an office into work areas
Limiting access to sensitive information to those with a specific need-to-know to prevent compromise of the whole program (Correct answer)
Using filing cabinets for classified documents

Correct answer: Limiting access to sensitive information to those with a specific need-to-know to prevent compromise of the whole program

Compartmentation in OPSEC limits access to sensitive information to only those who need it for their specific tasks, ensuring that a single compromise doesn't expose the entire program.

Question 17: Which of the following describes the 'Availability' component of the CIA triad?

The process of verifying the identity of a user.
The assurance that authorized users can access information and systems when required. (Correct answer)
The assurance that information is not disclosed to unauthorized individuals.
The guarantee that data is accurate and has not been tampered with.

Correct answer: The assurance that authorized users can access information and systems when required.

Availability ensures that systems, applications, and data are accessible to authorized users when they need them. It involves protecting against downtime caused by hardware failures, software bugs, or malicious attacks like Denial of Service (DoS).

Question 18: What is a Sensitive Compartmented Information Facility (SCIF)?

A classified government database containing compartmented intelligence records
A portable encryption device used for secure classified communications
A cleared contractor facility approved to perform Top Secret contract work
An accredited area where SCI may be stored, processed, and discussed (Correct answer)

Correct answer: An accredited area where SCI may be stored, processed, and discussed

A SCIF is an accredited area, room, or building that meets specific construction and security standards and has been officially approved for the storage, processing, and discussion of Sensitive Compartmented Information.

Question 19: What does 'threat awareness' training for security professionals typically include?

Only cybersecurity topics
Historical analysis of past security incidents
Understanding the nature of threats, recognizing indicators of targeting, and knowing how to respond (Correct answer)
Learning to fight off attackers

Correct answer: Understanding the nature of threats, recognizing indicators of targeting, and knowing how to respond

Threat awareness training covers recognizing potential threats, understanding the tactics adversaries use, identifying indicators of surveillance or targeting, and knowing the appropriate response procedures.

Question 20: Which type of physical intrusion detection system (PIDS) sensor is specifically designed to detect an unauthorized entry through a door or window?

A glass-break detector
A passive infrared (PIR) sensor
A magnetic contact switch (Correct answer)
A microwave sensor

Correct answer: A magnetic contact switch

A magnetic contact switch consists of two parts: a magnet attached to a door or window and a switch on the frame. When the door or window is opened, the magnetic field is broken, which triggers the alarm. This makes it a direct detector of an opening, whereas other sensors detect motion (PIR, microwave) or the sound of breaking glass.

Question 21: What is the primary purpose of an Incident Command System (ICS)?

Manage financial resources only
Provide a standardized approach to command and control (Correct answer)
Coordinate media communications
Track employee attendance during emergencies

Correct answer: Provide a standardized approach to command and control

ICS provides a standardized, on-scene, all-hazard incident management approach that allows for the integration of facilities, equipment, personnel, procedures, and communications.

Question 22: Under what circumstances may classified information be discussed over a standard non-secure telephone line?

Never — classified information must not be discussed over non-secure telephone lines (Correct answer)
When the call is made from within an approved government facility
When the conversation is brief and no specific operational details are mentioned
When both parties hold appropriate clearances for the information being discussed

Correct answer: Never — classified information must not be discussed over non-secure telephone lines

Classified information must never be discussed over standard non-secure telephone lines regardless of the parties' clearance levels, because unsecured communications channels are vulnerable to interception.

Question 23: What action should employees take when they observe suspicious behavior by a colleague?

Confront the colleague directly
Post about it on the company intranet
Report the behavior through established reporting mechanisms to the insider threat program or security officer (Correct answer)
Ignore it unless they are certain it is a security violation

Correct answer: Report the behavior through established reporting mechanisms to the insider threat program or security officer

Employees should report suspicious behavior through established channels, such as the insider threat reporting hotline or directly to the security officer, rather than confronting the colleague.

Question 24: A security analyst is reviewing access logs for a sensitive database server. The analyst is primarily concerned with ensuring that the data has not been altered or deleted by unauthorized individuals. Which principle of the CIA triad is the analyst's main focus?

Confidentiality
Non-repudiation
Availability
Integrity (Correct answer)

Correct answer: Integrity

Integrity is the principle that ensures data is trustworthy and has not been subject to unauthorized modification or destruction. The analyst's focus on preventing alteration or deletion directly relates to maintaining the integrity of the data.

Question 25: What is 'two-person integrity' (TPI) in physical security?

Using two different types of locks on secure areas
A requirement for two-factor authentication on all systems
Having two security guards on duty at all times
A control requiring two authorized individuals to be present whenever access to highly sensitive materials or areas occurs (Correct answer)

Correct answer: A control requiring two authorized individuals to be present whenever access to highly sensitive materials or areas occurs

TPI requires two authorized individuals to be present simultaneously when accessing, handling, or performing operations on particularly sensitive materials or areas, preventing any single individual from acting unilaterally.

Question 26: What is the purpose of the Personnel Security Investigation (PSI) process?

To assess job performance
To evaluate candidates for promotions
To investigate criminal activity
To determine whether an individual is eligible for a security clearance (Correct answer)

Correct answer: To determine whether an individual is eligible for a security clearance

A PSI is conducted to gather information about an individual's background to determine their eligibility and suitability for a security clearance.

Question 27: What is the significance of 'personal protective equipment' in a security context?

Items like body armor and trauma kits that protect security professionals from physical harm (Correct answer)
Only relevant for physical labor
Software that protects personal computers
Encryption tools for personal communications

Correct answer: Items like body armor and trauma kits that protect security professionals from physical harm

In security contexts, personal protective equipment includes physical protection items such as body armor, helmets, and first aid supplies used to protect security professionals from physical harm.

Question 28: What is the primary purpose of the NIST Risk Management Framework (RMF)?

To provide a structured process for integrating security and privacy risk management into the system development lifecycle (Correct answer)
To manage financial investment risk
To certify software products
To train cybersecurity professionals

Correct answer: To provide a structured process for integrating security and privacy risk management into the system development lifecycle

The NIST RMF provides a comprehensive process for managing information security and privacy risk throughout the system development lifecycle, from design through decommission.

Question 29: What is 'identity theft' and why is it a personal security concern?

Assuming a false identity for undercover operations
The fraudulent acquisition and use of another person's private identifying information (Correct answer)
Using a nickname professionally
Changing one's legal name

Correct answer: The fraudulent acquisition and use of another person's private identifying information

Identity theft involves using another person's personal information without their consent, typically for financial gain, and can severely impact the victim's reputation and security clearance.

Question 30: What is an 'OPSEC indicator' as used in the five-step OPSEC process?

Observable actions or information that could allow an adversary to detect, identify, or derive critical information (Correct answer)
A security training certification
A security clearance level
A type of classified marking

Correct answer: Observable actions or information that could allow an adversary to detect, identify, or derive critical information

OPSEC indicators are observable data or activities that can be detected and analyzed by an adversary to deduce critical information about friendly operations.

Question 31: What is 'defense in depth' in information security?

Defending only the perimeter of a network
Using the most advanced security technology available
Using multiple layers of security controls so that if one fails, others still provide protection (Correct answer)
Encrypting only the most sensitive data

Correct answer: Using multiple layers of security controls so that if one fails, others still provide protection

Defense in depth is a security strategy that employs multiple layers of controls, ensuring that if one control fails, additional controls continue to provide protection.

Question 32: According to Executive Order 13556, which of the following is considered a type of controlled unclassified information (CUI)?

North Atlantic Treaty Organization (NATO) Information
Law Enforcement Sensitive (LES) Information (Correct answer)
Declassified Information
Communications Security (COMSEC) Information

Correct answer: Law Enforcement Sensitive (LES) Information

When a classified data spill occurs, the Activity Security Manager (ASM) is typically the primary individual responsible for ensuring that all policy requirements for addressing the unauthorized disclosure are met. The ASM oversees the incident response, investigation, mitigation, and reporting processes to contain the spill and prevent recurrence.

Question 33: What is the purpose of a 'security classification guide' (SCG)?

To provide a list of cleared personnel
To outline employee security responsibilities
To identify specific items, elements, or categories of information that are classified and their required classification levels (Correct answer)
To describe facility security procedures

Correct answer: To identify specific items, elements, or categories of information that are classified and their required classification levels

A SCG identifies specific information elements related to a classified program and prescribes their classification levels, downgrading instructions, and declassification guidance.

Question 34: What is 'pretext calling' in the context of personal security threats?

Calling someone before an important meeting
Making phone calls from a landline
Scheduling calls in advance
Using a false scenario to manipulate a target into revealing information (Correct answer)

Correct answer: Using a false scenario to manipulate a target into revealing information

Pretext calling involves creating a fabricated scenario to manipulate a target into revealing confidential information or performing an action.

Question 35: What is an 'authorization boundary' in the context of the NIST RMF?

A physical fence around a data center
The defined scope of what is included in a system for security authorization purposes (Correct answer)
The limit on the number of authorized users
A type of network firewall

Correct answer: The defined scope of what is included in a system for security authorization purposes

The authorization boundary defines the scope of what components and elements are included within a system and subject to the security authorization under the RMF.

Question 36: What is the role of 'physical security surveys' in a security program?

Systematic assessments of a facility's physical security measures to identify vulnerabilities and recommend improvements (Correct answer)
Reviews of access badge issuance procedures
Annual inspections of fire safety equipment only
Interviewing employees about job satisfaction

Correct answer: Systematic assessments of a facility's physical security measures to identify vulnerabilities and recommend improvements

Physical security surveys systematically evaluate all aspects of a facility's physical security program to identify vulnerabilities and recommend countermeasures to reduce security risks.

Question 37: What category of information does 'Restricted Data' (RD) specifically refer to under U.S. law?

Personnel security records protected under the Privacy Act of 1974
Financial information related to classified government acquisition programs
Information concerning nuclear weapons design, production, and special nuclear materials (Correct answer)
Intelligence sources and methods requiring compartmented access controls

Correct answer: Information concerning nuclear weapons design, production, and special nuclear materials

Restricted Data, as defined by the Atomic Energy Act, refers specifically to information about nuclear weapons design, production, and special nuclear materials, and is classified by statute rather than executive order.

Question 38: A small tech company is bidding on a government contract that will require access to SECRET information. Before the company can be awarded the contract, the Defense Counterintelligence and Security Agency (DCSA) must grant what type of clearance?

Personnel Security Clearance (PCL) for the CEO
Sensitive Compartmented Information (SCI) eligibility
Facility Clearance (FCL) (Correct answer)
Information Systems (IS) Accreditation

Correct answer: Facility Clearance (FCL)

A Facility Clearance (FCL) is an administrative determination that a company is eligible for access to classified information at a specific level. It is a prerequisite for any company to perform on a classified contract.

Question 39: Under Executive Order 13526, who is authorized to make original classification decisions?

The Director of National Intelligence exclusively
All cleared contractors working on classified programs
Any government employee holding an active security clearance
The President, Vice President, and officials designated by the President (Correct answer)

Correct answer: The President, Vice President, and officials designated by the President

EO 13526 designates the President, Vice President, and agency heads or officials specifically designated by the President as Original Classification Authorities (OCAs).

Question 40: Which of the following is a good practice for protecting personal information online?

Regularly reviewing and adjusting privacy settings on social media (Correct answer)
Using the same password for all accounts
Sharing your location on all social platforms
Accepting all friend requests

Correct answer: Regularly reviewing and adjusting privacy settings on social media

Regularly reviewing and adjusting privacy settings limits the amount of personal information accessible to potential adversaries or identity thieves.

Question 41: What is 'two-factor authentication' (2FA)?

Having two passwords for a single account
Using two separate computers to access a system
A security process requiring two different types of verification before granting access (Correct answer)
Logging in twice to confirm identity

Correct answer: A security process requiring two different types of verification before granting access

2FA requires users to provide two different types of verification factors — something they know, something they have, or something they are — to access a system.

Question 42: What is 'security information and event management' (SIEM)?

A type of physical security alarm system
A method for organizing security training events
A system that collects and analyzes security events from across an organization to identify threats (Correct answer)
A performance management system for security staff

Correct answer: A system that collects and analyzes security events from across an organization to identify threats

SIEM systems collect and correlate security events and logs from across an organization's IT infrastructure to provide real-time threat detection and compliance reporting.

Question 43: What is the primary subject matter of Executive Order 13526?

Classified national security information policy (Correct answer)
Physical security requirements for classified facilities
Cybersecurity requirements for classified networks
Personnel security investigation standards

Correct answer: Classified national security information policy

EO 13526, signed in 2009, establishes U.S. government policy for classifying, safeguarding, and declassifying national security information, replacing EO 12958.

Question 44: What is the purpose of the industrial security inspection program?

To verify compliance with NISPOM requirements and assess the effectiveness of security measures (Correct answer)
To evaluate employee job performance
To review contract deliverables
To conduct financial audits of contractors

Correct answer: To verify compliance with NISPOM requirements and assess the effectiveness of security measures

Industrial security inspections are conducted by the cognizant security agency to verify contractor compliance with NISPOM requirements and the effectiveness of their security programs.

Question 45: What is a 'vehicle barrier system' and when is it used?

Vehicle registration checkpoints
Physical barriers (bollards, walls, vehicle traps) designed to prevent vehicle-borne attacks against facilities (Correct answer)
Tire deflation devices for unauthorized vehicles
Speed bumps for employee parking lots

Correct answer: Physical barriers (bollards, walls, vehicle traps) designed to prevent vehicle-borne attacks against facilities

Vehicle barrier systems prevent vehicle-borne threats (such as car bombs or ramming attacks) from reaching critical facilities by using passive or active physical barriers.

Question 46: What is the purpose of a security vulnerability assessment in industrial security?

To identify weaknesses that could allow unauthorized access to classified information (Correct answer)
To assess financial risks
To review supply chain logistics
To evaluate employee performance

Correct answer: To identify weaknesses that could allow unauthorized access to classified information

A security vulnerability assessment identifies gaps and weaknesses in security systems that could be exploited to gain unauthorized access to classified information.

Question 47: Which NIMS component establishes standardized identification and support mechanisms for resources?

Ongoing Management and Maintenance
Resource Management (Correct answer)
Command and Coordination
Communications and Information Management

Correct answer: Resource Management

Resource Management under NIMS establishes standardized mechanisms to identify, acquire, allocate, and track resources.

Question 48: What is the significance of 'security zones' in physical security planning?

Areas designated for security staff breaks
Zones defined by employee departments
Areas where security cameras are installed
Defined areas with different security levels and controls that determine what level of access and protection is required in each zone (Correct answer)

Correct answer: Defined areas with different security levels and controls that determine what level of access and protection is required in each zone

Security zones define areas with different security requirements, ensuring that the most sensitive assets are surrounded by the strongest protective measures while allowing less restricted access to lower-sensitivity areas.

Question 49: Which of the following is NOT a characteristic of a Special Access Program?

Broad dissemination of information (Correct answer)
Limited access based on need-to-know
Strict access approval process
Enhanced security measures

Correct answer: Broad dissemination of information

While Program Security Officers (PSOs) manage the day-to-day security of SAPs, the Designated Accrediting Authority (DAA) is typically responsible for the formal accreditation of the program's security posture, which includes approving access. The DAA ensures that the SAP meets all security requirements and that only authorized personnel are granted access.

Question 50: What is a classified 'working paper' as defined in information security handling guidelines?

A classified document approved for wide distribution within an authorized agency
A document generated during preparation of a classified product, such as notes or drafts (Correct answer)
An unclassified summary of a classified program authorized for public release
A temporary access authorization form issued for new employees pending full clearance

Correct answer: A document generated during preparation of a classified product, such as notes or drafts

Working papers are documents such as notes, drafts, and supporting materials created during the preparation of classified finished products, and they require the same protection as classified documents if they contain classified information.

Question 51: Which of the following security program areas would you find practitioners working with a facility's Antiterrorism Officer to deploy defensive measures designed to reduce the facility's vulnerability from terrorist attacks?

Industrial Security
Information Security
Personnel Security
Physical Security (Correct answer)

Correct answer: Physical Security

Physical Security focuses on protecting personnel, property, and information from unauthorized access, damage, or theft through physical means. This program area involves deploying defensive measures, such as barriers, access controls, and surveillance systems, often in collaboration with Antiterrorism Officers, to reduce a facility's vulnerability to terrorist attacks.

Question 52: A small company has developed a new proprietary manufacturing process. They are concerned about competitors stealing their trade secrets. Which of the following is the BEST control to mitigate this risk?

Installing antivirus software on all company computers.
Enforcing a strong password policy for all employees.
Implementing a firewall to block external network traffic.
Requiring all employees with access to the process documents to sign non-disclosure agreements (NDAs). (Correct answer)

Correct answer: Requiring all employees with access to the process documents to sign non-disclosure agreements (NDAs).

While technical controls like firewalls and passwords are important, the most direct control to protect trade secrets from being shared by authorized individuals (insiders) is a legal control like a non-disclosure agreement (NDA). It legally binds employees to protect the company's confidential information.

Security Fundamentals Professional Certification (SFPC)

The SFPC exam validates foundational knowledge of DoD security disciplines including personnel security, information security, physical security, industrial security, and operations security.

Questions

120 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds